pve-cluster: Phase 4 als Rolle – Admin-Gruppe/-Konten, Healer-Token, Benachrichtigungen, Firewall mit IPSET management (Tasks 4.1–4.4)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-13 17:05:30 +02:00
parent 5c790cc8d4
commit 81602373fc
6 changed files with 309 additions and 0 deletions
@@ -0,0 +1,20 @@
+# Verwaltet von Ansible (Rolle pve-cluster, Vorlage cluster.fw.j2). Änderungen im Repo, nicht hier.
+[OPTIONS]
+
+enable: {{ 1 if knaster_pve.firewall.enable else 0 }}
+policy_in: DROP
+policy_out: ACCEPT
+log_ratelimit: enable=1,rate=10/second,burst=5
+
+[IPSET management] # Zugang zu 8006, 22, 5900-5999, 3128, 60000-60050 (Proxmox-Standardregeln)
+
+{% for host in groups['pve_all'] | sort %}
+{{ hostvars[host].ansible_host }} # Knoten {{ host }}
+{% endfor %}
+{% for m in knaster_pve.firewall.management %}
+{{ m.ip }} # {{ m.comment }}
+{% endfor %}
+
+[RULES]
+
+IN ACCEPT -source {{ knaster_pve.firewall.ping_from }} -p icmp -log nolog # Ping aus dem LAN